diff --git a/assets/get-started/quickstart/init-bundle-admin.json b/assets/get-started/quickstart/init-bundle-admin.json index 06203e8..7d4771a 100644 --- a/assets/get-started/quickstart/init-bundle-admin.json +++ b/assets/get-started/quickstart/init-bundle-admin.json @@ -27,36 +27,60 @@ }, { "resource": { - "resourceType": "FHIRSchema", - "url": "http://aidbox.app/StructureDefinition/Client/created-by", + "resourceType": "StructureDefinition", "id": "client-created-by", - "base": "Extension", + "url": "http://aidbox.app/StructureDefinition/Client/created-by", "name": "client-created-by", + "status": "active", "kind": "complex-type", + "abstract": false, "type": "Extension", - "version": "0.0.1", - "elements": { - "url": { - "fixed": "http://aidbox.app/StructureDefinition/Client/created-by" - }, - "value": { - "choices": [ - "valueReference" - ] - }, - "valueReference": { - "type": "Reference", - "refers": [ - "User" - ], - "choiceOf": "value" + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension", + "derivation": "constraint", + "context": [ + { + "type": "element", + "expression": "Client" } - }, - "derivation": "constraint" + ], + "differential": { + "element": [ + { + "id": "Extension", + "path": "Extension", + "min": 0, + "max": "1" + }, + { + "id": "Extension.extension", + "path": "Extension.extension", + "max": "0" + }, + { + "id": "Extension.url", + "path": "Extension.url", + "fixedUri": "http://aidbox.app/StructureDefinition/Client/created-by" + }, + { + "id": "Extension.value[x]", + "path": "Extension.value[x]", + "min": 1, + "max": "1", + "type": [ + { + "code": "Reference", + "targetProfile": [ + "http://health-samurai.io/fhir/core/StructureDefinition/User" + ] + } + ] + } + ] + } }, "request": { "method": "PUT", - "url": "FHIRSchema/client-created-by" + "url": "StructureDefinition/client-created-by" } }, { @@ -81,39 +105,65 @@ }, { "resource": { - "resourceType": "FHIRSchema", - "url": "http://aidbox.app/StructureDefinition/Client/status", + "resourceType": "StructureDefinition", "id": "client-status", - "base": "Extension", + "url": "http://aidbox.app/StructureDefinition/Client/status", "name": "client-status", + "status": "active", "kind": "complex-type", + "abstract": false, "type": "Extension", - "version": "0.0.2", - "elements": { - "url": { - "fixed": "http://aidbox.app/StructureDefinition/Client/status" - }, - "value": { - "choices": [ - "valueCode" - ] - }, - "valueCode": { - "type": "code", - "choiceOf": "value", - "constraints": { - "enum-client-status": { - "severity": "error", - "expression": "%context.subsetOf('draft' | 'review' | 'active' | 'rejected')" - } - } + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension", + "derivation": "constraint", + "context": [ + { + "type": "element", + "expression": "Client" } - }, - "derivation": "constraint" + ], + "differential": { + "element": [ + { + "id": "Extension", + "path": "Extension", + "min": 0, + "max": "1" + }, + { + "id": "Extension.extension", + "path": "Extension.extension", + "max": "0" + }, + { + "id": "Extension.url", + "path": "Extension.url", + "fixedUri": "http://aidbox.app/StructureDefinition/Client/status" + }, + { + "id": "Extension.value[x]", + "path": "Extension.value[x]", + "min": 1, + "max": "1", + "type": [ + { + "code": "code" + } + ], + "constraint": [ + { + "key": "enum-client-status", + "severity": "error", + "human": "status must be one of draft | review | active | rejected", + "expression": "$this.subsetOf('draft' | 'review' | 'active' | 'rejected')" + } + ] + } + ] + } }, "request": { "method": "PUT", - "url": "FHIRSchema/client-status" + "url": "StructureDefinition/client-status" } }, { @@ -142,7 +192,8 @@ "id": "smartbox-admin-portal", "first_party": true, "grant_types": [ - "code" + "code", + "password" ], "scope": [ "openid", @@ -157,6 +208,9 @@ "pkce": true, "refresh_token": true, "refresh_token_expiration": 86400 + }, + "password": { + "access_token_expiration": 300 } } }, @@ -180,92 +234,54 @@ } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-session" + }, "resource": { "resourceType": "AccessPolicy", - "id": "admin-api", + "id": "admin-api-session", "engine": "matcho", - "description": "Scoped access for admin API client (sessions, orgs, clients, users, tos/privacy)", "matcho": { "client": { "id": "admin-api" }, - "$one-of": [ - { - "params": { - "resource/type": "Session" - }, - "operation": { - "id": { - "$one-of": [ - "FhirCreate", - "FhirSearch", - "FhirRead", - "FhirUpdate", - "FhirPatch" - ] - } - } - }, - { - "params": { - "resource/type": "Organization" - }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead" - ] - } - } - }, - { - "params": { - "resource/type": "Client" - }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead" - ] - } - } - }, - { - "params": { - "resource/type": "User" - }, - "operation": { - "id": "FhirRead" - } - }, - { - "params": { - "resource/type": "DocumentReference", - "resource/id": { - "$one-of": [ - "smartbox-tos", - "smartbox-privacy" - ] - } - }, - "operation": { - "id": { - "$one-of": [ - "FhirRead", - "FhirUpdate", - "FhirCreate" - ] - } - } - } - ] - } - }, + "request-method": { + "$one-of": [ + "get", + "post", + "put", + "patch", + "delete" + ] + }, + "uri": { + "$one-of": [ + "#^/fhir/Session.*", + "#^/Session.*" + ] + } + }, + "description": "Full CRUD access to Session for admin API client" + } + }, + { "request": { "method": "PUT", - "url": "AccessPolicy/admin-api" + "url": "AccessPolicy/admin-api-identity-provider" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-identity-provider", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "request-method": "get", + "uri": "#^/IdentityProvider.*" + }, + "description": "Read-only IdentityProvider access for admin API client (backend maps OIDC third-party initiated login iss to an IdP id)" } }, { @@ -290,156 +306,544 @@ } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-grant" + }, "resource": { "resourceType": "AccessPolicy", - "id": "allow-read-settings", + "id": "admin-api-grant", "engine": "matcho", - "description": "Allow admin-api client to read Aidbox settings", "matcho": { "client": { "id": "admin-api" }, + "request-method": { + "$one-of": [ + "get", + "post", + "put", + "patch", + "delete" + ] + }, "uri": { "$one-of": [ - "/api/v1/settings/introspect", - "^/api/v1/settings/.*" + "#^/fhir/Grant.*", + "#^/Grant.*" ] } - } - }, - "request": { - "method": "PUT", - "url": "AccessPolicy/allow-read-settings" + }, + "description": "Full CRUD access to Grant for admin API client" } }, { - "resource": { - "resourceType": "SearchParameter", - "id": "Communication.about", - "url": "http://smartbox.hs/sp/Communication-about", - "name": "communication-about", - "status": "active", - "code": "about", - "base": [ - "Communication" - ], - "type": "reference", - "description": "Search Communication by Communication.about (any reference, incl. Aidbox system resources)", - "expression": "Communication.about" - }, "request": { "method": "PUT", - "url": "SearchParameter/Communication.about" + "url": "AccessPolicy/admin-api-batch" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-batch", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "request-method": "post", + "uri": "#^/fhir$" + }, + "description": "Allow batch/transaction operations for admin API client" } }, { - "resource": { - "resourceType": "SearchParameter", - "id": "Session.client", - "url": "http://smartbox.hs/sp/Session-client", - "name": "session-client", - "status": "active", - "code": "client", - "base": [ - "Session" - ], - "type": "reference", - "description": "Search Session by client reference", - "expression": "Session.client", - "target": [ - "Client" - ] - }, "request": { "method": "PUT", - "url": "SearchParameter/Session.client" - } - }, - { + "url": "AccessPolicy/admin-api-organization" + }, "resource": { - "roles": [ - { - "type": "admin" + "resourceType": "AccessPolicy", + "id": "admin-api-organization", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "params": { + "resource/type": "Organization" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead" + ] + } } - ] - }, - "request": { - "method": "PATCH", - "url": "User/admin" + }, + "description": "Scoped access for admin API client (organizations)" } }, { "request": { "method": "PUT", - "url": "AccessPolicy/patient-can-get-launch-uri" + "url": "AccessPolicy/admin-api-client" }, "resource": { "resourceType": "AccessPolicy", - "id": "patient-can-get-launch-uri", - "type": "rpc", - "engine": "matcho-rpc", - "rpc": { - "aidbox.smart/get-launch-uri": { - "user": { - "fhirUser": { - "resourceType": "Patient" - } + "id": "admin-api-client", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "params": { + "resource/type": "Client" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "FhirDelete" + ] } } - } + }, + "description": "Scoped access for admin API client (clients, incl. E2E teardown)" } }, { "request": { "method": "PUT", - "url": "AccessPolicy/smart-app-can-read-patient-api" + "url": "AccessPolicy/admin-api-user" }, "resource": { "resourceType": "AccessPolicy", - "id": "smart-app-can-read-patient-api", + "id": "admin-api-user", "engine": "matcho", "matcho": { - "jwt": { - "atv": 2, - "scope": "present?", - "context": { - "patient": "present?" - } - }, "client": { - "type": "smart-app", - "active": true + "id": "admin-api" + }, + "params": { + "resource/type": "User" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "FhirCreate", + "FhirUpdate", + "FhirPatch", + "FhirDelete", + "Search", + "Read", + "Create", + "Update", + "Patch", + "Delete" + ] + } } - } + }, + "description": "Full CRUD access to User for admin API client (FHIR and native Aidbox API)" } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-document-reference" + }, "resource": { - "resourceType": "DocumentReference", - "id": "smartbox-tos", - "status": "current", - "type": { - "text": "Terms of Service" - }, - "category": [ - { - "text": "legal" - } - ], - "content": [ - { - "attachment": { - "contentType": "text/html" + "resourceType": "AccessPolicy", + "id": "admin-api-document-reference", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "params": { + "resource/id": { + "$one-of": [ + "smartbox-tos", + "smartbox-privacy", + "smartbox-theme", + "smartbox-enrollment-message", + "smartbox-app-name", + "smartbox-app-logo", + "mpf-export-scope" + ] + }, + "resource/type": "DocumentReference" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirUpdate", + "FhirCreate" + ] + } + } + }, + "description": "Scoped access for admin-api client to DocumentReference resources (tos, privacy, theme, enrollment message)" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-footer-config" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-footer-config", + "engine": "matcho", + "matcho": { + "client": { + "id": "admin-api" + }, + "params": { + "resource/id": "#^footer-config-.*", + "resource/type": "DocumentReference" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirUpdate", + "FhirCreate" + ] } } + }, + "description": "Allow admin-api client to read/write footer config DocumentReference (id prefix footer-config-*)" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "allow-read-settings", + "engine": "matcho", + "description": "Allow admin-api client to read Aidbox settings", + "matcho": { + "client": { + "id": "admin-api" + }, + "uri": { + "$one-of": [ + "/api/v1/settings/introspect", + "^/api/v1/settings/.*" + ] + } + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/allow-read-settings" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-sql", + "engine": "matcho", + "description": "Allow admin-api client to execute SQL queries for patient enrollment lookup", + "matcho": { + "client": { + "id": "admin-api" + }, + "uri": "/$sql", + "request-method": "post" + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-sql" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-audit-event", + "engine": "matcho", + "description": "Allow admin-api client to create and read AuditEvent resources for enrollment audit logging", + "matcho": { + "client": { + "id": "admin-api" + }, + "params": { + "resource/type": "AuditEvent" + }, + "operation": { + "id": { + "$one-of": [ + "FhirCreate", + "FhirSearch", + "FhirRead" + ] + } + } + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-audit-event" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-notification", + "engine": "matcho", + "description": "Allow admin-api client to create, send, and delete Notification resources for email notifications", + "matcho": { + "client": { + "id": "admin-api" + }, + "request-method": { + "$one-of": [ + "put", + "post", + "delete" + ] + }, + "uri": { + "$one-of": [ + "#^/Notification.*" + ] + } + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-notification" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "Communication.about", + "url": "http://smartbox.hs/sp/Communication-about", + "name": "communication-about", + "status": "active", + "code": "about", + "base": [ + "Communication" + ], + "type": "reference", + "description": "Search Communication by Communication.about (any reference, incl. Aidbox system resources)", + "expression": "Communication.about" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Communication.about" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "Communication.identifier", + "url": "http://smartbox.hs/sp/Communication-identifier", + "name": "communication-identifier", + "status": "active", + "code": "identifier", + "base": [ + "Communication" + ], + "type": "token", + "description": "Search Communication by identifier (system|value)", + "expression": "Communication.identifier" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Communication.identifier" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "Session.client", + "url": "http://smartbox.hs/sp/Session-client", + "name": "session-client", + "status": "active", + "code": "client", + "base": [ + "Session" + ], + "type": "reference", + "description": "Search Session by client reference", + "expression": "Session.client", + "target": [ + "Client" + ] + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Session.client" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "Session.refresh-token-exp", + "url": "http://smartbox.hs/sp/Session-refresh-token-exp", + "name": "session-refresh-token-exp", + "status": "active", + "code": "refresh_token_exp", + "base": [ + "Session" + ], + "type": "number", + "description": "Search Session by refresh token expiration time (unix epoch seconds)", + "expression": "Session.refresh_token_exp" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Session.refresh-token-exp" + } + }, + { + "resource": { + "roles": [ + { + "type": "admin" + } ] }, + "request": { + "method": "PATCH", + "url": "User/admin" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/patient-can-get-launch-uri" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "patient-can-get-launch-uri", + "type": "rpc", + "engine": "matcho-rpc", + "rpc": { + "aidbox.smart/get-launch-uri": { + "user": { + "fhirUser": { + "resourceType": "Patient" + } + } + } + } + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/patient-can-get-smart-apps" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "patient-can-get-smart-apps", + "engine": "matcho", + "matcho": { + "user": { + "fhirUser": { + "resourceType": "Patient" + } + }, + "params": { + "status": "active", + ".type": "smart-app", + "resource/type": "Client" + }, + "operation": { + "id": "FhirSearch" + } + } + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/patient-can-create-communication" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "patient-can-create-communication", + "engine": "matcho", + "matcho": { + "user": { + "fhirUser": { + "resourceType": "Patient" + } + }, + "params": { + "resource/type": "Communication" + }, + "operation": { + "id": "FhirCreate" + } + } + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/smart-app-can-read-patient-api" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "smart-app-can-read-patient-api", + "engine": "matcho", + "matcho": { + "jwt": { + "atv": 2, + "scope": "present?", + "context": { + "patient": "present?" + } + }, + "client": { + "type": "smart-app", + "active": true + } + } + } + }, + { "request": { "method": "PUT", "url": "DocumentReference/smartbox-tos" + }, + "resource": { + "resourceType": "DocumentReference", + "id": "smartbox-tos", + "status": "current", + "type": { + "text": "Terms of Service" + }, + "category": [ + { + "text": "legal" + } + ], + "content": [ + { + "attachment": { + "url": "http://localhost:8095/change-me-smartbox-tos.pdf", + "contentType": "application/pdf" + } + } + ] } }, { + "request": { + "method": "PUT", + "url": "DocumentReference/smartbox-privacy" + }, "resource": { "resourceType": "DocumentReference", "id": "smartbox-privacy", @@ -459,103 +863,207 @@ } } ] + } + }, + { + "resource": { + "resourceType": "AuthConfig", + "id": "smartbox", + "theme": { + "styleUrl": "http://localhost:8095/auth.css" + } }, "request": { "method": "PUT", - "url": "DocumentReference/smartbox-privacy" + "url": "AuthConfig/smartbox" } }, { "resource": { - "resourceType": "FHIRSchema", - "url": "http://smartbox.hs/StructureDefinition/AwsAccount", - "id": "AwsAccount", - "name": "AwsAccount", - "type": "AwsAccount", - "kind": "resource", - "derivation": "specialization", - "elements": { - "region": { - "type": "string" + "engine": "matcho", + "description": "Admin access to Client resources", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] }, - "access-key-id": { - "type": "string" + "params": { + "resource/type": "Client" + } + }, + "id": "admin-role-client", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-client" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin search and read Session resources", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] }, - "secret-access-key": { - "type": "string" + "params": { + "resource/type": "Session" }, - "host": { - "type": "string" + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead" + ] + } + } + }, + "id": "admin-role-session", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-session" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin access to Organization resources", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] }, - "path-style": { - "type": "boolean" + "params": { + "resource/type": "Organization" + } + }, + "id": "admin-role-organization", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-role-organization" + } + }, + { + "resource": { + "engine": "matcho", + "description": "Admin read Patient with ORGBAC", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] }, - "use-ssl": { - "type": "boolean" + "params": { + "resource/type": "Patient" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "orgbac-fhir-search", + "orgbac-fhir-read" + ] + } } - } + }, + "id": "admin-role-patient", + "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "FHIRSchema/AwsAccount" + "url": "AccessPolicy/admin-role-patient" } }, { "resource": { - "resourceType": "AwsAccount", - "id": "minio", - "region": "us-east-1", - "access-key-id": "minioadmin", - "secret-access-key": "minioadmin", - "host": "minio:9000", - "path-style": true, - "use-ssl": false + "engine": "matcho", + "description": "Admin read User with ORGBAC", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "User" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "orgbac-fhir-search", + "orgbac-fhir-read" + ] + } + } + }, + "id": "admin-role-user", + "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AwsAccount/minio" + "url": "AccessPolicy/admin-role-user" } }, { "resource": { - "resourceType": "FHIRSchema", - "url": "http://smartbox.hs/StructureDefinition/GcpServiceAccount", - "id": "GcpServiceAccount", - "name": "GcpServiceAccount", - "type": "GcpServiceAccount", - "kind": "resource", - "derivation": "specialization", - "elements": { - "private-key": { - "type": "string" + "engine": "matcho", + "description": "Admin read Group with ORGBAC", + "matcho": { + "user": { + "roles": [ + { + "type": "admin" + } + ] + }, + "params": { + "resource/type": "Group" }, - "service-account-email": { - "type": "string" + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "orgbac-fhir-search", + "orgbac-fhir-read" + ] + } } - } - }, - "request": { - "method": "PUT", - "url": "FHIRSchema/GcpServiceAccount" - } - }, - { - "resource": { - "resourceType": "AuthConfig", - "id": "smartbox", - "theme": { - "styleUrl": "http://localhost:3001/auth.css" - } + }, + "id": "admin-role-group", + "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AuthConfig/smartbox" + "url": "AccessPolicy/admin-role-group" } }, { "resource": { "engine": "matcho", - "description": "Admin access to Client resources", + "description": "Admin manage DocumentReference", "matcho": { "user": { "roles": [ @@ -565,21 +1073,30 @@ ] }, "params": { - "resource/type": "Client" + "resource/type": "DocumentReference" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "FhirUpdate" + ] + } } }, - "id": "admin-role-client", + "id": "admin-role-document-reference", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-client" + "url": "AccessPolicy/admin-role-document-reference" } }, { "resource": { "engine": "matcho", - "description": "Admin search and read Session resources", + "description": "Admin access to settings endpoints", "matcho": { "user": { "roles": [ @@ -588,30 +1105,36 @@ } ] }, - "params": { - "resource/type": "Session" + "request": { + "uri": { + "$one-of": [ + "/api/v1/settings/introspect", + "^/api/v1/settings/.*" + ] + } }, "operation": { "id": { "$one-of": [ "FhirSearch", - "FhirRead" + "FhirRead", + "FhirUpdate" ] } } }, - "id": "admin-role-session", + "id": "admin-role-settings-introspect", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-session" + "url": "AccessPolicy/admin-role-settings-introspect" } }, { "resource": { "engine": "matcho", - "description": "Admin access to Organization resources", + "description": "Admin access to AwsAccount resources", "matcho": { "user": { "roles": [ @@ -621,21 +1144,21 @@ ] }, "params": { - "resource/type": "Organization" + "resource/type": "AwsAccount" } }, - "id": "admin-role-organization", + "id": "admin-role-aws-account", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-organization" + "url": "AccessPolicy/admin-role-aws-account" } }, { "resource": { "engine": "matcho", - "description": "Admin read Patient with ORGBAC", + "description": "Admin access to GcpServiceAccount resources", "matcho": { "user": { "roles": [ @@ -645,31 +1168,21 @@ ] }, "params": { - "resource/type": "Patient" - }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead", - "orgbac-fhir-search", - "orgbac-fhir-read" - ] - } + "resource/type": "GcpServiceAccount" } }, - "id": "admin-role-patient", + "id": "admin-role-gcp-service-account", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-patient" + "url": "AccessPolicy/admin-role-gcp-service-account" } }, { "resource": { "engine": "matcho", - "description": "Admin read User with ORGBAC", + "description": "Admin search and read AuditEvent resources", "matcho": { "user": { "roles": [ @@ -679,31 +1192,29 @@ ] }, "params": { - "resource/type": "User" + "resource/type": "AuditEvent" }, "operation": { "id": { "$one-of": [ "FhirSearch", - "FhirRead", - "orgbac-fhir-search", - "orgbac-fhir-read" + "FhirRead" ] } } }, - "id": "admin-role-user", + "id": "admin-role-audit-event", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-user" + "url": "AccessPolicy/admin-role-audit-event" } }, { "resource": { "engine": "matcho", - "description": "Admin read Group with ORGBAC", + "description": "Admin search and read Communication resources", "matcho": { "user": { "roles": [ @@ -713,176 +1224,447 @@ ] }, "params": { - "resource/type": "Group" + "resource/type": "Communication" }, "operation": { "id": { "$one-of": [ "FhirSearch", - "FhirRead", - "orgbac-fhir-search", - "orgbac-fhir-read" + "FhirRead" ] } } }, - "id": "admin-role-group", + "id": "admin-role-communication", "resourceType": "AccessPolicy" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-group" + "url": "AccessPolicy/admin-role-communication" + } + }, + { + "resource": { + "url": "http://aidbox.app/StructureDefinition/AuditEvent/client", + "id": "AuditEvent.client", + "base": [ + "AuditEvent" + ], + "expression": "AuditEvent.agent.who.identifier.value", + "name": "client", + "status": "active", + "type": "token", + "resourceType": "SearchParameter", + "code": "client", + "description": "Filter AuditEvent by client identifier (agent.who.identifier.value)" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/AuditEvent.client" + } + }, + { + "resource": { + "resourceType": "StructureDefinition", + "id": "FaqPage", + "url": "http://aidbox.app/StructureDefinition/FaqPage", + "name": "FaqPage", + "status": "active", + "kind": "resource", + "abstract": false, + "type": "FaqPage", + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/DomainResource", + "derivation": "specialization", + "differential": { + "element": [ + { + "id": "FaqPage", + "path": "FaqPage", + "min": 0, + "max": "*" + }, + { + "id": "FaqPage.items", + "path": "FaqPage.items", + "min": 0, + "max": "*", + "type": [ + { + "code": "BackboneElement" + } + ] + }, + { + "id": "FaqPage.items.id", + "path": "FaqPage.items.id", + "min": 0, + "max": "1", + "type": [ + { + "code": "string" + } + ] + }, + { + "id": "FaqPage.items.question", + "path": "FaqPage.items.question", + "min": 0, + "max": "1", + "type": [ + { + "code": "string" + } + ] + }, + { + "id": "FaqPage.items.answer", + "path": "FaqPage.items.answer", + "min": 0, + "max": "1", + "type": [ + { + "code": "markdown" + } + ] + } + ] + } + }, + "request": { + "method": "PUT", + "url": "StructureDefinition/FaqPage" } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-faqpage" + }, "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-faqpage", "engine": "matcho", - "description": "Admin manage DocumentReference", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] + "client": { + "id": "admin-api" }, "params": { - "resource/type": "DocumentReference" + "resource/type": "FaqPage" + }, + "operation": { + "id": "Read" + } + }, + "description": "Scoped access for admin API client (FAQ pages - read only)" + } + }, + { + "request": { + "method": "PUT", + "url": "NotificationTemplate/auth-signup-email" + }, + "resource": { + "resourceType": "NotificationTemplate", + "subject": "Confirm your Member Account", + "template": "\n

Confirm your email address

\n

Hello {{params.data.name}}{{params.email}}{{params.username}}!

\n

We just need to verify that {{params.email}} {{params.username}} is your email address.

\n

Confirm Email Address

\nDidn't request this email?\n

No worries! Your address may have been entered by mistake. If you ignore or delete this email, nothing further will happen.

\n

If you're having problems, please feel free to write to us at FHIRsupport@villagecare.org. We'll be glad to help.

" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/box-ui-faqpage" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "box-ui-faqpage", + "engine": "matcho", + "matcho": { + "client": { + "id": "box-ui" + }, + "params": { + "resource/type": "FaqPage" }, "operation": { "id": { "$one-of": [ - "FhirSearch", "FhirRead", - "FhirUpdate" + "FhirSearch" ] } } }, - "id": "admin-role-document-reference", - "resourceType": "AccessPolicy" + "description": "Allow Aidbox UI to read FAQ pages" + } + }, + { + "resource": { + "resourceType": "Patient", + "id": "test-e2e-patient", + "name": [ + { + "given": [ + "E2E" + ], + "family": "TestPatient" + } + ], + "birthDate": "1990-01-01", + "gender": "unknown" + }, + "request": { + "method": "PUT", + "url": "Patient/test-e2e-patient" + } + }, + { + "resource": { + "resourceType": "User", + "id": "test-e2e-smartbox-patient", + "email": "test-e2e-patient@smartbox.dev", + "password": "Test123!@#", + "fhirUser": { + "id": "test-e2e-patient", + "resourceType": "Patient" + }, + "data": { + "firstName": "E2E", + "lastName": "TestPatient" + }, + "roles": [ + { + "type": "patient" + } + ] + }, + "request": { + "method": "PUT", + "url": "User/test-e2e-smartbox-patient" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "provider-directory-public-read", + "engine": "matcho", + "description": "Allow admin-api client to read provider directory resources", + "matcho": { + "uri": { + "$one-of": [ + "#^/fhir/PractitionerRole($|/|\\?)", + "#^/fhir/Practitioner($|/|\\?)", + "#^/fhir/Location($|/|\\?)", + "#^/fhir/Organization($|/|\\?)", + "#^/fhir/HealthcareService($|/|\\?)" + ] + }, + "request-method": "get", + "client": { + "id": "admin-api" + } + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/provider-directory-public-read" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-patient-write", + "engine": "matcho", + "description": "Allow admin-api client to write Patient resources for enrollment telecom updates", + "matcho": { + "client": { + "id": "admin-api" + }, + "request-method": { + "$one-of": [ + "patch", + "put" + ] + }, + "uri": "#^/fhir/Patient($|/|\\?)" + } }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-document-reference" + "url": "AccessPolicy/admin-api-patient-write" } }, { "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-registration-read", "engine": "matcho", - "description": "Admin access to settings endpoints", + "description": "Allow admin-api client to read Registration resources for enrollment status lookup", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] - }, - "request": { - "uri": { - "$one-of": [ - "/api/v1/settings/introspect", - "^/api/v1/settings/.*" - ] - } + "client": { + "id": "admin-api" }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead", - "FhirUpdate" - ] - } - } - }, - "id": "admin-role-settings-introspect", - "resourceType": "AccessPolicy" + "request-method": "get", + "uri": "#^/fhir/Registration($|/|\\?)" + } }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-settings-introspect" + "url": "AccessPolicy/admin-api-registration-read" } }, { "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-access-policy", "engine": "matcho", - "description": "Admin access to AwsAccount resources", + "description": "Allow admin-api client to manage per-backend-service AccessPolicies (bs-policy-*) created/removed on app approval/deactivation (#478)", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } + "client": { + "id": "admin-api" + }, + "request-method": { + "$one-of": [ + "get", + "put", + "post", + "delete" ] }, - "params": { - "resource/type": "AwsAccount" + "uri": { + "$one-of": [ + "#^/AccessPolicy/bs-policy-.*", + "#^/fhir/AccessPolicy/bs-policy-.*" + ] } - }, - "id": "admin-role-aws-account", - "resourceType": "AccessPolicy" + } }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-aws-account" + "url": "AccessPolicy/admin-api-access-policy" } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/admin-api-force-reset-password" + }, "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-force-reset-password", "engine": "matcho", - "description": "Admin access to GcpServiceAccount resources", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] + "client": { + "id": "admin-api" }, - "params": { - "resource/type": "GcpServiceAccount" - } + "request-method": "post", + "uri": "#^/auth/force-reset-password.*" }, - "id": "admin-role-gcp-service-account", - "resourceType": "AccessPolicy" + "description": "Allow admin API client to issue password reset links via /auth/force-reset-password" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "User.role", + "url": "http://smartbox.hs/sp/User-role", + "name": "user-role", + "status": "active", + "code": "role", + "base": [ + "User" + ], + "type": "token", + "description": "Search User by role type (User.roles[].type), e.g. /User?role=admin. FHIRPath traverses the roles array, so a role at any index matches.", + "expression": "User.roles.type" }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-gcp-service-account" + "url": "SearchParameter/User.role" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "User.patient", + "url": "http://smartbox.hs/sp/User-patient", + "name": "user-patient", + "status": "active", + "code": "patient", + "base": [ + "User" + ], + "type": "reference", + "target": [ + "Patient" + ], + "description": "Linked Patient for an enrolled member. Covers both link shapes: the enrollment flow writes User.fhirUser ({id,resourceType}) and legacy/imported members link via User.data.patient. Powers the enrolled-members list, which pages enrolled Users with /fhir/User?patient:missing=false (matches both shapes) and then fetches that page's Patients. NOTE: avoid reverse chaining (Patient?_has:User:patient:...) — it is too slow on large datasets; and Aidbox value-matches only Aidbox-format references, so :missing is the reliable modifier here. Index for scale: GIN on the User resource (see aidbox.index/suggest-index).", + "expression": "User.fhirUser | User.data.patient" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/User.patient" + } + }, + { + "resource": { + "source": "https://storage.googleapis.com/aidbox-public/smartbox/all_data.ndjson.gz" + }, + "request": { + "method": "POST", + "url": "/$load" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "plannet-practitionerrole-network", + "url": "http://hl7.org/fhir/us/davinci-pdex-plan-net/SearchParameter/practitionerrole-network", + "version": "1.2.0-aidbox-fixed", + "name": "Plannet_sp_practitionerrole_network", + "status": "active", + "description": "Select roles where the practitioner is a member of the specified health insurance provider network. NOTE: the IG 1.2.0 expression is missing the trailing .value (selects the Extension, not the Reference) and Aidbox cannot compile it - fixed here.", + "code": "network", + "base": [ + "PractitionerRole" + ], + "type": "reference", + "expression": "PractitionerRole.extension.where(url='http://hl7.org/fhir/us/davinci-pdex-plan-net/StructureDefinition/network-reference').value" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/plannet-practitionerrole-network" + } + }, + { + "request": { + "method": "PUT", + "url": "AidboxConfig/smartbox" + }, + "resource": { + "id": "smartbox", + "resourceType": "AidboxConfig", + "smartbox": { + "logoUrl": "https://storage.googleapis.com/aidbox-public/smartbox/health-system-logo.png" + } } }, { "resource": { + "resourceType": "AccessPolicy", + "id": "admin-api-client-patch", "engine": "matcho", - "description": "Admin search and read AuditEvent resources", + "description": "Allow the admin-api client to PATCH a single Client resource by id in the admin (PHI) box. The backend uses this to propagate developer-portal changes to approved clients into the production box. Single-resource PATCH only; collection/conditional PATCH, full-resource replace, and other write methods are denied.", "matcho": { - "user": { - "roles": [ - { - "type": "admin" - } - ] - }, - "params": { - "resource/type": "AuditEvent" + "client": { + "id": "admin-api" }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead" - ] - } - } - }, - "id": "admin-role-audit-event", - "resourceType": "AccessPolicy" + "request-method": "patch", + "uri": "#^/fhir/Client/[^/?]+$" + } }, "request": { "method": "PUT", - "url": "AccessPolicy/admin-role-audit-event" + "url": "AccessPolicy/admin-api-client-patch" } }, { @@ -903,65 +1685,76 @@ }, { "resource": { - "url": "http://aidbox.app/StructureDefinition/AuditEvent/client", - "id": "AuditEvent.client", - "base": [ - "AuditEvent" - ], - "expression": "AuditEvent.agent.who.identifier.value", - "name": "client", - "status": "active", - "type": "token", - "resourceType": "SearchParameter", - "code": "client", - "description": "Filter AuditEvent by client identifier (agent.who.identifier.value)" + "resourceType": "FHIRSchema", + "url": "http://smartbox.hs/StructureDefinition/AwsAccount", + "id": "AwsAccount", + "name": "AwsAccount", + "type": "AwsAccount", + "kind": "resource", + "derivation": "specialization", + "elements": { + "region": { + "type": "string" + }, + "access-key-id": { + "type": "string" + }, + "secret-access-key": { + "type": "string" + }, + "host": { + "type": "string" + }, + "path-style": { + "type": "boolean" + }, + "use-ssl": { + "type": "boolean" + } + } }, "request": { "method": "PUT", - "url": "SearchParameter/AuditEvent.client" + "url": "FHIRSchema/AwsAccount" } }, { - "request": { - "method": "POST", - "url": "/$fhir-package-install" + "resource": { + "resourceType": "AwsAccount", + "id": "minio", + "region": "us-east-1", + "access-key-id": "minioadmin", + "secret-access-key": "minioadmin", + "host": "minio:9000", + "path-style": true, + "use-ssl": false }, + "request": { + "method": "PUT", + "url": "AwsAccount/minio" + } + }, + { "resource": { - "resourceType": "Parameters", - "parameter": [ - { - "name": "package", - "valueString": "hl7.fhir.us.core@6.1.0" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.carin-bb@2.0.0" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.davinci-pdex@2.0.0" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.davinci-drug-formulary@2.0.1" - }, - { - "name": "package", - "valueString": "hl7.fhir.us.davinci-pdex-plan-net@1.1.0" - }, - { - "name": "package", - "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-pas%402.0.1.tar.gz" - }, - { - "name": "package", - "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-dtr%402.0.1.tar.gz" + "resourceType": "FHIRSchema", + "url": "http://smartbox.hs/StructureDefinition/GcpServiceAccount", + "id": "GcpServiceAccount", + "name": "GcpServiceAccount", + "type": "GcpServiceAccount", + "kind": "resource", + "derivation": "specialization", + "elements": { + "private-key": { + "type": "string" }, - { - "name": "package", - "valueString": "https://storage.googleapis.com/aidbox-public/smartbox/hl7.fhir.us.davinci-crd%402.0.1.tar.gz" + "service-account-email": { + "type": "string" } - ] + } + }, + "request": { + "method": "PUT", + "url": "FHIRSchema/GcpServiceAccount" } }, { diff --git a/assets/get-started/quickstart/init-bundle-developer.json b/assets/get-started/quickstart/init-bundle-developer.json index ae52323..6621d9a 100644 --- a/assets/get-started/quickstart/init-bundle-developer.json +++ b/assets/get-started/quickstart/init-bundle-developer.json @@ -4,36 +4,60 @@ "entry": [ { "resource": { - "resourceType": "FHIRSchema", - "url": "http://aidbox.app/StructureDefinition/Client/created-by", + "resourceType": "StructureDefinition", "id": "client-created-by", - "base": "Extension", + "url": "http://aidbox.app/StructureDefinition/Client/created-by", "name": "client-created-by", + "status": "active", "kind": "complex-type", + "abstract": false, "type": "Extension", - "version": "0.0.1", - "elements": { - "url": { - "fixed": "http://aidbox.app/StructureDefinition/Client/created-by" - }, - "value": { - "choices": [ - "valueReference" - ] - }, - "valueReference": { - "type": "Reference", - "refers": [ - "User" - ], - "choiceOf": "value" + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension", + "derivation": "constraint", + "context": [ + { + "type": "element", + "expression": "Client" } - }, - "derivation": "constraint" + ], + "differential": { + "element": [ + { + "id": "Extension", + "path": "Extension", + "min": 0, + "max": "1" + }, + { + "id": "Extension.extension", + "path": "Extension.extension", + "max": "0" + }, + { + "id": "Extension.url", + "path": "Extension.url", + "fixedUri": "http://aidbox.app/StructureDefinition/Client/created-by" + }, + { + "id": "Extension.value[x]", + "path": "Extension.value[x]", + "min": 1, + "max": "1", + "type": [ + { + "code": "Reference", + "targetProfile": [ + "http://health-samurai.io/fhir/core/StructureDefinition/User" + ] + } + ] + } + ] + } }, "request": { "method": "PUT", - "url": "FHIRSchema/client-created-by" + "url": "StructureDefinition/client-created-by" } }, { @@ -58,39 +82,65 @@ }, { "resource": { - "resourceType": "FHIRSchema", - "url": "http://aidbox.app/StructureDefinition/Client/status", + "resourceType": "StructureDefinition", "id": "client-status", - "base": "Extension", + "url": "http://aidbox.app/StructureDefinition/Client/status", "name": "client-status", + "status": "active", "kind": "complex-type", + "abstract": false, "type": "Extension", - "version": "0.0.2", - "elements": { - "url": { - "fixed": "http://aidbox.app/StructureDefinition/Client/status" - }, - "value": { - "choices": [ - "valueCode" - ] - }, - "valueCode": { - "type": "code", - "choiceOf": "value", - "constraints": { - "enum-client-status": { - "severity": "error", - "expression": "%context.subsetOf('draft' | 'review' | 'active' | 'rejected')" - } - } + "baseDefinition": "http://hl7.org/fhir/StructureDefinition/Extension", + "derivation": "constraint", + "context": [ + { + "type": "element", + "expression": "Client" } - }, - "derivation": "constraint" + ], + "differential": { + "element": [ + { + "id": "Extension", + "path": "Extension", + "min": 0, + "max": "1" + }, + { + "id": "Extension.extension", + "path": "Extension.extension", + "max": "0" + }, + { + "id": "Extension.url", + "path": "Extension.url", + "fixedUri": "http://aidbox.app/StructureDefinition/Client/status" + }, + { + "id": "Extension.value[x]", + "path": "Extension.value[x]", + "min": 1, + "max": "1", + "type": [ + { + "code": "code" + } + ], + "constraint": [ + { + "key": "enum-client-status", + "severity": "error", + "human": "status must be one of draft | review | active | rejected", + "expression": "$this.subsetOf('draft' | 'review' | 'active' | 'rejected')" + } + ] + } + ] + } }, "request": { "method": "PUT", - "url": "FHIRSchema/client-status" + "url": "StructureDefinition/client-status" } }, { @@ -151,6 +201,20 @@ "url": "Client/smartbox-developer-portal" } }, + { + "resource": { + "resourceType": "Client", + "id": "developer-api", + "secret": "developer-api-secret-change-in-production", + "grant_types": [ + "client_credentials" + ] + }, + "request": { + "method": "PUT", + "url": "Client/developer-api" + } + }, { "resource": { "fhirUser": { @@ -230,73 +294,180 @@ } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-session" + }, "resource": { - "resourceType": "Client", - "id": "developer-api", - "secret": "developer-api-secret-change-in-production", - "grant_types": [ - "client_credentials" - ] + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "Session" + }, + "operation": { + "id": { + "$one-of": [ + "FhirCreate", + "FhirSearch", + "FhirRead", + "FhirUpdate", + "FhirPatch" + ] + } + } + }, + "description": "Scoped access for developer API client (sessions)", + "id": "developer-api-session", + "resourceType": "AccessPolicy" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-organization" + }, + "resource": { + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "Organization" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead" + ] + } + } + }, + "description": "Scoped access for developer API client (organizations)", + "id": "developer-api-organization", + "resourceType": "AccessPolicy" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-user" }, + "resource": { + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "User" + }, + "operation": { + "id": "FhirRead" + } + }, + "description": "Scoped access for developer API client (users)", + "id": "developer-api-user", + "resourceType": "AccessPolicy" + } + }, + { "request": { "method": "PUT", - "url": "Client/developer-api" + "url": "AccessPolicy/developer-api-client" + }, + "resource": { + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "Client" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead", + "FhirDelete" + ] + } + } + }, + "description": "Scoped access for developer API client (clients, incl. E2E teardown)", + "id": "developer-api-client", + "resourceType": "AccessPolicy" } }, { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-footer-config" + }, "resource": { "resourceType": "AccessPolicy", - "id": "developer-api", + "id": "developer-api-footer-config", "engine": "matcho", - "description": "Scoped access for developer API client (sessions, oauth state, orgs, users)", "matcho": { "client": { "id": "developer-api" }, - "$one-of": [ - { - "params": { - "resource/type": "Session" - }, - "operation": { - "id": { - "$one-of": [ - "FhirCreate", - "FhirSearch", - "FhirRead", - "FhirUpdate", - "FhirPatch" - ] - } - } - }, - { - "params": { - "resource/type": "Organization" - }, - "operation": { - "id": { - "$one-of": [ - "FhirSearch", - "FhirRead" - ] - } - } - }, - { - "params": { - "resource/type": "User" - }, - "operation": { - "id": "FhirRead" - } + "params": { + "resource/id": "#^footer-config-.*", + "resource/type": "DocumentReference" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirUpdate", + "FhirCreate" + ] } - ] - } - }, + } + }, + "description": "Allow developer-api client to read/write footer config DocumentReference (id prefix footer-config-*)" + } + }, + { "request": { "method": "PUT", - "url": "AccessPolicy/developer-api" + "url": "AccessPolicy/developer-api-document-reference" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "developer-api-document-reference", + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/id": { + "$one-of": [ + "smartbox-tos", + "smartbox-privacy", + "smartbox-enrollment-message" + ] + }, + "resource/type": "DocumentReference" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirUpdate", + "FhirCreate" + ] + } + } + }, + "description": "Scoped access for developer-api client to DocumentReference resources (tos, privacy, enrollment message)" } }, { @@ -532,7 +703,8 @@ }, "resource": { "resourceType": "NotificationTemplate", - "template": "\n

Confirm your email address

\n

Hello {{params.data.name}}{{params.email}}{{params.username}}!

\n

We just need to verify that {{params.email}} {{params.username}} is your email address.

\n

Confirm Email Address

\nDidn't request this email?\n

No worries! Your address may have been entered by mistake. If you ignore or delete this email, nothing further will happen.

\n

If you're having problems, please feel free to write to us at hello@health-samurai.io. We'll be glad to help.

" + "template": "\n

Confirm your email address

\n

Hello {{params.data.name}}{{params.email}}{{params.username}}!

\n

We just need to verify that {{params.email}} {{params.username}} is your email address.

\n

Confirm Email Address

\nDidn't request this email?\n

No worries! Your address may have been entered by mistake. If you ignore or delete this email, nothing further will happen.

\n

If you're having problems, please feel free to write to us at hello@health-samurai.io. We'll be glad to help.

", + "subject": "Confirm your Developer Account" } }, { @@ -596,17 +768,49 @@ }, "params": { "resource/type": "Communication", - ".about.0.reference": "present?" + "about": "present?" }, "operation": { "id": "FhirSearch" } }, - "description": "Developers can search communication for sertain app", + "description": "Developers can search communication for certain app", "id": "dev-client-search-communication", "resourceType": "AccessPolicy" } }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/dev-read-compartment-definition" + }, + "resource": { + "resourceType": "AccessPolicy", + "id": "dev-read-compartment-definition", + "engine": "matcho", + "description": "Developers can read CompartmentDefinition (SMART scope picker enumerates patient compartment)", + "matcho": { + "user": { + "roles": { + "$contains": { + "type": "developer" + } + } + }, + "params": { + "resource/type": "CompartmentDefinition" + }, + "operation": { + "id": { + "$one-of": [ + "FhirSearch", + "FhirRead" + ] + } + } + } + } + }, { "request": { "method": "PUT", @@ -631,6 +835,46 @@ } } }, + { + "request": { + "method": "PUT", + "url": "DocumentReference/smartbox-tos" + }, + "resource": { + "resourceType": "DocumentReference", + "id": "smartbox-tos", + "status": "current", + "type": { + "text": "Terms of Service" + }, + "category": [ + { + "text": "legal" + } + ], + "content": [ + { + "attachment": { + "contentType": "application/pdf", + "url": "http://localhost:8096/change-me-smartbox-tos.pdf" + } + } + ] + } + }, + { + "resource": { + "resourceType": "AuthConfig", + "id": "smartbox", + "theme": { + "styleUrl": "http://localhost:8096/auth.css" + } + }, + "request": { + "method": "PUT", + "url": "AuthConfig/smartbox" + } + }, { "resource": { "engine": "matcho", @@ -648,21 +892,221 @@ }, "description": "Admin access to Client resources", "id": "developer-role-client", + "resourceType": "AccessPolicy" + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-role-client" + } + }, + { + "resource": { + "resourceType": "User", + "id": "test-e2e-smartbox-dev", + "email": "test-e2e@smartbox.dev", + "password": "Test123!@#", + "data": { + "firstName": "E2E", + "lastName": "Test", + "phone": "+1 555 0100", + "companyName": "E2E Health Systems", + "companyUrl": "https://e2e.example.com", + "role": "developer", + "emailVerified": true + }, + "roles": [ + { + "type": "developer" + } + ] + }, + "request": { + "method": "PUT", + "url": "User/test-e2e-smartbox-dev" + } + }, + { + "resource": { + "resourceType": "SearchParameter", + "id": "Communication.about", + "url": "http://hl7.org/fhir/SearchParameter/Communication-about", + "name": "about", + "status": "active", + "code": "about", + "base": [ + "Communication" + ], + "type": "reference", + "description": "Search Communication by about reference", + "expression": "Communication.about" + }, + "request": { + "method": "PUT", + "url": "SearchParameter/Communication.about" + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-grant" + }, + "resource": { "resourceType": "AccessPolicy", - "meta": { - "lastUpdated": "2025-12-11T17:05:59.203507Z", - "versionId": "2895", - "extension": [ - { - "url": "https://aidbox.app/ex/createdAt", - "valueInstant": "2025-12-11T17:05:59.203507Z" + "id": "developer-api-grant", + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "request-method": { + "$one-of": [ + "get", + "post", + "put", + "patch", + "delete" + ] + }, + "uri": { + "$one-of": [ + "#^/fhir/Grant.*", + "#^/Grant.*" + ] + } + }, + "description": "Full CRUD access to Grant for developer API client" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "developer-api-sql", + "engine": "matcho", + "description": "Allow developer-api client to execute SQL queries for patient enrollment lookup", + "matcho": { + "client": { + "id": "developer-api" + }, + "uri": "/$sql", + "request-method": "post" + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-sql" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "developer-api-audit-event", + "engine": "matcho", + "description": "Allow developer-api client to create and read AuditEvent resources for enrollment audit logging", + "matcho": { + "client": { + "id": "developer-api" + }, + "params": { + "resource/type": "AuditEvent" + }, + "operation": { + "id": { + "$one-of": [ + "FhirCreate", + "FhirSearch", + "FhirRead" + ] } - ] + } } }, "request": { "method": "PUT", - "url": "AccessPolicy/developer-role-client" + "url": "AccessPolicy/developer-api-audit-event" + } + }, + { + "resource": { + "resourceType": "AccessPolicy", + "id": "dev-backend-service-read", + "engine": "matcho", + "description": "Sandbox: any backend service (bulk-api-client) may read/search the shared synthetic dataset before approval, mirroring dev-smart-app-read (#478)", + "matcho": { + "client": { + "type": "bulk-api-client" + }, + "operation": { + "id": { + "$one-of": [ + "FhirRead", + "FhirSearch" + ] + } + } + } + }, + "request": { + "method": "PUT", + "url": "AccessPolicy/dev-backend-service-read" + } + }, + { + "request": { + "method": "PUT", + "url": "AidboxConfig/smartbox" + }, + "resource": { + "id": "smartbox", + "resourceType": "AidboxConfig", + "smartbox": { + "logoUrl": "https://storage.googleapis.com/aidbox-public/smartbox/health-system-logo.png" + } + } + }, + { + "request": { + "method": "PUT", + "url": "DocumentReference/smartbox-privacy" + }, + "resource": { + "resourceType": "DocumentReference", + "id": "smartbox-privacy", + "status": "current", + "type": { + "text": "Privacy Policy" + }, + "category": [ + { + "text": "legal" + } + ], + "content": [ + { + "attachment": { + "url": "http://localhost:8096/change-me-smartbox-privacy.html", + "contentType": "text/html" + } + } + ] + } + }, + { + "request": { + "method": "PUT", + "url": "AccessPolicy/developer-api-identity-provider" + }, + "resource": { + "engine": "matcho", + "matcho": { + "client": { + "id": "developer-api" + }, + "request-method": "get", + "uri": "#^/IdentityProvider.*" + }, + "description": "Read-only IdentityProvider access for developer API client (backend maps OIDC third-party initiated login iss to an IdP id)", + "id": "developer-api-identity-provider", + "resourceType": "AccessPolicy" } } ]